2 * Declarations of routines for {fragment,segment} reassembly
4 * Wireshark - Network traffic analyzer
5 * By Gerald Combs <gerald@wireshark.org>
6 * Copyright 1998 Gerald Combs
8 * This program is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU General Public License
10 * as published by the Free Software Foundation; either version 2
11 * of the License, or (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 /* make sure that all flags that are set in a fragment entry is also set for
24 * the flags field of fd_head !!!
30 #include "ws_symbol_export.h"
32 /* only in fd_head: packet is defragmented */
33 #define FD_DEFRAGMENTED 0x0001
35 /* there are overlapping fragments */
36 #define FD_OVERLAP 0x0002
38 /* overlapping fragments contain different data */
39 #define FD_OVERLAPCONFLICT 0x0004
41 /* more than one fragment which indicates end-of data */
42 #define FD_MULTIPLETAILS 0x0008
44 /* fragment starts before the end of the datagram but extends
45 past the end of the datagram */
46 #define FD_TOOLONGFRAGMENT 0x0010
48 /* fragment tvb is subset, don't tvb_free() it */
49 #define FD_SUBSET_TVB 0x0020
51 /* this flag is used to request fragment_add to continue the reassembly process */
52 #define FD_PARTIAL_REASSEMBLY 0x0040
54 /* fragment offset is indicated by sequence number and not byte offset
55 into the defragmented packet */
56 #define FD_BLOCKSEQUENCE 0x0100
58 /* if REASSEMBLE_FLAGS_CHECK_DATA_PRESENT is set, and the first fragment is
59 * incomplete, this flag is set in the flags word on the fd_head returned.
61 * It's all a fudge to preserve historical behaviour.
63 #define FD_DATA_NOT_PRESENT 0x0200
65 /* This flag is set in (only) fd_head to denote that datalen has been set to a valid value.
66 * It's implied by FD_DEFRAGMENTED (we must know the total length of the
67 * datagram if we have defragmented it...)
69 #define FD_DATALEN_SET 0x0400
71 typedef struct _fragment_item {
72 struct _fragment_item *next;
73 guint32 frame; /* XXX - does this apply to reassembly heads? */
74 guint32 offset; /* XXX - does this apply to reassembly heads? */
75 guint32 len; /* XXX - does this apply to reassembly heads? */
76 guint32 fragment_nr_offset; /**< offset for frame numbering, for sequences, where the
77 * provided fragment number of the first fragment does
79 * XXX - does this apply only to reassembly heads? */
80 guint32 datalen; /**< When flags&FD_BLOCKSEQUENCE is set, the
81 index of the last block (segments in
82 datagram + 1); otherwise the number of
83 bytes of the full datagram. Only valid in
84 the first item of the fragments list when
85 flags&FD_DATALEN is set.*/
86 guint32 reassembled_in; /**< frame where this PDU was reassembled,
87 only valid in the first item of the list
88 and when FD_DEFRAGMENTED is set*/
89 guint8 reas_in_layer_num; /**< The current "depth" or layer number in the current frame where reassembly was completed.
90 * Example: in SCTP there can be several data chunks and we want the reassemblied tvb for the final
93 guint32 flags; /**< XXX - do some of these apply only to reassembly
94 heads and others only to fragments within
98 * Null if the reassembly had no error; non-null if it had
99 * an error, in which case it's the string for the error.
101 * XXX - this is wasted in all but the reassembly head; we
102 * should probably have separate data structures for a
103 * reassembly and for the fragments in a reassembly.
106 } fragment_item, fragment_head;
110 * Flags for fragment_add_seq_*
113 /* we don't have any sequence numbers - fragments are assumed to appear in
115 #define REASSEMBLE_FLAGS_NO_FRAG_NUMBER 0x0001
117 /* a special fudge for the 802.11 dissector */
118 #define REASSEMBLE_FLAGS_802_11_HACK 0x0002
120 /* causes fragment_add_seq_key to check that all the fragment data is present
121 * in the tvb, and if not, do something a bit odd. */
122 #define REASSEMBLE_FLAGS_CHECK_DATA_PRESENT 0x0004
125 * Generates a fragment identifier based on the given parameters. "data" is an
126 * opaque type whose interpretation is up to the caller of fragment_add*
127 * functions and the fragment key function (possibly NULL if you do not care).
129 * Keys returned by this function are only used within this packet scope.
131 typedef gpointer (*fragment_temporary_key)(const packet_info *pinfo,
132 const guint32 id, const void *data);
135 * Like fragment_temporary_key, but used for identifying reassembled fragments
136 * which may persist through multiple packets.
138 typedef gpointer (*fragment_persistent_key)(const packet_info *pinfo,
139 const guint32 id, const void *data);
142 * Data structure to keep track of fragments and reassemblies.
145 GHashTable *fragment_table;
146 GHashTable *reassembled_table;
147 fragment_temporary_key temporary_key_func;
148 fragment_persistent_key persistent_key_func;
149 GDestroyNotify free_temporary_key_func; /* temporary key destruction function */
153 * Table of functions for a reassembly table.
156 /* Functions for fragment table */
157 GHashFunc hash_func; /* hash function */
158 GEqualFunc equal_func; /* comparison function */
159 fragment_temporary_key temporary_key_func; /* temporary key creation function */
160 fragment_persistent_key persistent_key_func; /* persistent key creation function */
161 GDestroyNotify free_temporary_key_func; /* temporary key destruction function */
162 GDestroyNotify free_persistent_key_func; /* persistent key destruction function */
163 } reassembly_table_functions;
166 * Tables of functions exported for the benefit of dissectors that
167 * don't need special items in their keys.
169 WS_DLL_PUBLIC const reassembly_table_functions
170 addresses_reassembly_table_functions; /* keys have endpoint addresses and an ID */
171 WS_DLL_PUBLIC const reassembly_table_functions
172 addresses_ports_reassembly_table_functions; /* keys have endpoint addresses and ports and an ID */
175 * Initialize/destroy a reassembly table.
177 * init: If table doesn't exist: create table;
178 * else: just remove any entries;
179 * destroy: remove entries and destroy table;
182 reassembly_table_init(reassembly_table *table,
183 const reassembly_table_functions *funcs);
185 reassembly_table_destroy(reassembly_table *table);
188 * This function adds a new fragment to the reassembly table
189 * If this is the first fragment seen for this datagram, a new entry
190 * is created in the table, otherwise this fragment is just added
191 * to the linked list of fragments for this packet.
192 * The list of fragments for a specific datagram is kept sorted for
195 * Datagrams (messages) are identified by a key generated by
196 * fragment_temporary_key or fragment_persistent_key, based on the "pinfo", "id"
197 * and "data" pairs. (This is the sole purpose of "data".)
199 * Fragments are identified by "frag_offset".
201 * Returns a pointer to the head of the fragment data list if we have all the
202 * fragments, NULL otherwise. Note that the reassembled fragments list may have
203 * a non-zero fragment offset, the only guarantee is that no gaps exist within
206 WS_DLL_PUBLIC fragment_head *
207 fragment_add(reassembly_table *table, tvbuff_t *tvb, const int offset,
208 const packet_info *pinfo, const guint32 id, const void *data,
209 const guint32 frag_offset, const guint32 frag_data_len,
210 const gboolean more_frags);
212 * Like fragment_add, except that the fragment may be added to multiple
213 * reassembly tables. This is needed when multiple protocol layers try
214 * to add the same packet to the reassembly table.
216 WS_DLL_PUBLIC fragment_head *
217 fragment_add_multiple_ok(reassembly_table *table, tvbuff_t *tvb,
218 const int offset, const packet_info *pinfo,
219 const guint32 id, const void *data,
220 const guint32 frag_offset,
221 const guint32 frag_data_len,
222 const gboolean more_frags);
225 * Like fragment_add, but maintains a table for completed reassemblies.
227 * If the packet was seen before, return the head of the fully reassembled
228 * fragments list (NULL if there was none).
230 * Otherwise (if reassembly was not possible before), try to to add the new
231 * fragment to the fragments table. If reassembly is now possible, remove all
232 * (reassembled) fragments from the fragments table and store it as a completed
233 * reassembly. The head of this reassembled fragments list is returned.
235 * Otherwise (if reassembly is still not possible after adding this fragment),
238 WS_DLL_PUBLIC fragment_head *
239 fragment_add_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
240 const packet_info *pinfo, const guint32 id,
241 const void *data, const guint32 frag_offset,
242 const guint32 frag_data_len, const gboolean more_frags);
245 * Like fragment_add, but fragments have a block sequence number starting from
246 * zero (for the first fragment of each datagram). This differs from
247 * fragment_add for which the fragment may start at any offset.
249 * If this is the first fragment seen for this datagram, a new
250 * "fragment_head" structure is allocated to refer to the reassembled
253 * if "more_frags" is false, and either we have no sequence numbers, or
254 * are using the 802.11 hack (via fragment_add_seq_802_11), it is assumed that
255 * this is the only fragment in the datagram. The structure is not added to the
256 * hash table, and not given any fragments to refer to, but is just returned.
258 * In this latter case reassembly wasn't done (since there was only one
259 * fragment in the packet); dissectors can check the 'next' pointer on the
260 * returned list to see if this case was hit or not.
262 * Otherwise, this fragment is just added to the linked list of fragments
263 * for this packet; the fragment_item is also added to the fragment hash if
266 * If this packet completes assembly, these functions return the head of the
267 * fragment data; otherwise, they return null.
269 WS_DLL_PUBLIC fragment_head *
270 fragment_add_seq(reassembly_table *table, tvbuff_t *tvb, const int offset,
271 const packet_info *pinfo, const guint32 id, const void *data,
272 const guint32 frag_number, const guint32 frag_data_len,
273 const gboolean more_frags, const guint32 flags);
276 * Like fragment_add_seq, but maintains a table for completed reassemblies
277 * just like fragment_add_check.
279 WS_DLL_PUBLIC fragment_head *
280 fragment_add_seq_check(reassembly_table *table, tvbuff_t *tvb, const int offset,
281 const packet_info *pinfo, const guint32 id,
283 const guint32 frag_number, const guint32 frag_data_len,
284 const gboolean more_frags);
287 * Like fragment_add_seq_check, but immediately returns a fragment list for a
288 * new fragment. This is a workaround specific for the 802.11 dissector, do not
291 WS_DLL_PUBLIC fragment_head *
292 fragment_add_seq_802_11(reassembly_table *table, tvbuff_t *tvb,
293 const int offset, const packet_info *pinfo,
294 const guint32 id, const void *data,
295 const guint32 frag_number, const guint32 frag_data_len,
296 const gboolean more_frags);
299 * Like fragment_add_seq_check, but without explicit fragment number. Fragments
300 * are simply appended until no "more_frags" is false.
302 WS_DLL_PUBLIC fragment_head *
303 fragment_add_seq_next(reassembly_table *table, tvbuff_t *tvb, const int offset,
304 const packet_info *pinfo, const guint32 id,
305 const void *data, const guint32 frag_data_len,
306 const gboolean more_frags);
309 * Start a reassembly, expecting "tot_len" as the number of given fragments (not
310 * the number of bytes). Data can be added later using fragment_add_seq_check.
313 fragment_start_seq_check(reassembly_table *table, const packet_info *pinfo,
314 const guint32 id, const void *data,
315 const guint32 tot_len);
318 * Mark end of reassembly and returns the reassembled fragment (if completed).
319 * Use it when fragments were added with "more_flags" set while you discovered
320 * that no more fragments have to be added.
321 * XXX rename to fragment_finish as it works also for fragment_add?
323 WS_DLL_PUBLIC fragment_head *
324 fragment_end_seq_next(reassembly_table *table, const packet_info *pinfo,
325 const guint32 id, const void *data);
327 /* To specify the offset for the fragment numbering, the first fragment is added with 0, and
328 * afterwards this offset is set. All additional calls to off_seq_check will calculate
329 * the number in sequence in regards to the offset */
331 fragment_add_seq_offset(reassembly_table *table, const packet_info *pinfo, const guint32 id,
332 const void *data, const guint32 fragment_offset);
335 * Sets the expected index for the last block (for fragment_add_seq functions)
336 * or the expected number of bytes (for fragment_add functions). A reassembly
337 * must already have started.
339 * Note that for FD_BLOCKSEQUENCE tot_len is the index for the tail fragment.
340 * i.e. since the block numbers start at 0, if we specify tot_len==2, that
341 * actually means we want to defragment 3 blocks, block 0, 1 and 2.
344 fragment_set_tot_len(reassembly_table *table, const packet_info *pinfo,
345 const guint32 id, const void *data, const guint32 tot_len);
348 * Return the expected index for the last block (for fragment_add_seq functions)
349 * or the expected number of bytes (for fragment_add functions).
351 WS_DLL_PUBLIC guint32
352 fragment_get_tot_len(reassembly_table *table, const packet_info *pinfo,
353 const guint32 id, const void *data);
356 * This function will set the partial reassembly flag(FD_PARTIAL_REASSEMBLY) for a fh.
357 * When this function is called, the fh MUST already exist, i.e.
358 * the fh MUST be created by the initial call to fragment_add() before
359 * this function is called. Also note that this function MUST be called to indicate
360 * a fh will be extended (increase the already stored data). After calling this function,
361 * and if FD_DEFRAGMENTED is set, the reassembly process will be continued.
364 fragment_set_partial_reassembly(reassembly_table *table,
365 const packet_info *pinfo, const guint32 id,
368 /* This function is used to check if there is partial or completed reassembly state
369 * matching this packet. I.e. Are there reassembly going on or not for this packet?
371 WS_DLL_PUBLIC fragment_head *
372 fragment_get(reassembly_table *table, const packet_info *pinfo,
373 const guint32 id, const void *data);
375 /* The same for the reassemble table */
376 /* id *must* be the frame number for this to work! */
377 WS_DLL_PUBLIC fragment_head *
378 fragment_get_reassembled(reassembly_table *table, const guint32 id);
380 WS_DLL_PUBLIC fragment_head *
381 fragment_get_reassembled_id(reassembly_table *table, const packet_info *pinfo,
384 /* This will free up all resources and delete reassembly state for this PDU.
385 * Except if the PDU is completely reassembled, then it would NOT deallocate the
386 * buffer holding the reassembled data but instead return the TVB
388 * So, if you call fragment_delete and it returns non-NULL, YOU are responsible to
391 WS_DLL_PUBLIC tvbuff_t *
392 fragment_delete(reassembly_table *table, const packet_info *pinfo,
393 const guint32 id, const void *data);
395 /* This struct holds references to all the tree and field handles used when
396 * displaying the reassembled fragment tree in the packet details view. A
397 * dissector will populate this structure with its own tree and field handles
398 * and then invoke show_fragement_tree to have those items added to the packet
401 typedef struct _fragment_items {
405 int *hf_fragments; /* FT_NONE */
406 int *hf_fragment; /* FT_FRAMENUM */
407 int *hf_fragment_overlap; /* FT_BOOLEAN */
408 int *hf_fragment_overlap_conflict; /* FT_BOOLEAN */
409 int *hf_fragment_multiple_tails; /* FT_BOOLEAN */
410 int *hf_fragment_too_long_fragment; /* FT_BOOLEAN */
411 int *hf_fragment_error; /* FT_FRAMENUM */
412 int *hf_fragment_count; /* FT_UINT32 */
413 int *hf_reassembled_in; /* FT_FRAMENUM */
414 int *hf_reassembled_length; /* FT_UINT32 */
415 int *hf_reassembled_data; /* FT_BYTES */
420 WS_DLL_PUBLIC tvbuff_t *
421 process_reassembled_data(tvbuff_t *tvb, const int offset, packet_info *pinfo,
422 const char *name, fragment_head *fd_head, const fragment_items *fit,
423 gboolean *update_col_infop, proto_tree *tree);
425 WS_DLL_PUBLIC gboolean
426 show_fragment_tree(fragment_head *ipfd_head, const fragment_items *fit,
427 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);
429 WS_DLL_PUBLIC gboolean
430 show_fragment_seq_tree(fragment_head *ipfd_head, const fragment_items *fit,
431 proto_tree *tree, packet_info *pinfo, tvbuff_t *tvb, proto_item **fi);